OnePlus backdoor means hackers could take over your phone

If you have a OnePlus phone, you may be interested - and a little disturbed - to learn that the company is preinstalling an app that acts as a backdoor to root access.

Earlier, according to a post on Christopher Moore's blog, OnePlus is collecting sensitive private data like IMEI numbers, mobile network names and IMSI prefixes, MAC addresses, and more. This app is used by OnePlus to ensure that a device is working properly before it leaves the factory. They are able to gain root if they have a password to bypass privilege escalation checks. The application is a diagnostics tool called "EngineerMode" that Qualcomm developed and distributes to OEMs like OnePlus so they can test the hardware components of a device. The user can access manual tests like root status test, Global Positioning System test or the main activity by sending a command. After bringing it to attention, security outfit NowSecure reverse engineered it and found that it could easily be exploited with a simple ADB command to enable a backdoor into devices that have the application installed.

If it's there, anyone with physical access to your device can exploit EngineerMode to gain root access on your smartphone. The application is present in all OnePlus devices including 3, 3T and 5.

The app can diagnose Global Positioning System, check the root status, perform a series of automated tests, and more. Of course, expecting the developers to unlock the bootloader for each device during its testing phases would be ridiculous, but its inclusion does pose security risks for everyday users.

OnePlus did not immediately respond to a request for comment. If it was overlooked, it is likely the upcoming 5T would have it also, which would necessitate removing the app before the device ships on November 16.

Recommended

Now an undeveloped patch of desert 45 minutes west of Phoenix, the future of Belmont might hinge on old-fashioned infrastructure. Several big players working on autonomous vehicles including Intel, Uber and Waymo are testing innovations in Arizona.

The Food and Drug Administration has approved the first drug that can digitally track whether patients have taken their medicine. The patch and sensor is manufactured by the company Proteus Digital Health and aripiprazole marketed by Otsuka Pharmaceutical.

Before heading out to the mall or going online, it is helpful to make a list of what you need to buy and what you'd like to buy. To protect you on Black Friday, the BBB advises consumers to not believe all they see or hear without doing their own research.

Along similar lines, Nintendo is set to launch a Netflix-like service for classic retro games on its Switch platform in 2018. When Kotaku reached out to GameStop about the suspension, the company said "program limitations" were largely to blame.

With Android 8.1 Oreo, when a device is running low on space, an automatic cleanup process will tidy after these unused apps. If you haven't yet been able to tell, we're pretty sarcastic when writing our headlines for Android Distribution updates.

Johnston told local media at least three people are dead, but did not elaborate if any students were among the dead. Multiple shots were fired at about 8am local time at the Rancho Tehama School on the outskirts of Corning.

President Donald Trump exchanged war-like threats and insults over the North's nuclear and missile development programme. Global leaders have begun arriving here in Manila, the Philippines for the 31st ASEAN-related summits.

Rand Paul: 'No Justification' For Neighbor's Attack
Paul is expected to vote on administration confirmation hearings and the Republican tax reform bill this week. Paul said there will be a criminal prosecution in this case, and added that he is recovering as expected .

Old £10 note to disappear next year
The old paper £10 note will no longer be legal tender from 1 March 2018, the Bank of England has announced. But the old note can still be exchanged by the Bank after the cut-off date.

Rescue efforts end after deadly Iran quake
The worst damage appeared to be in the Kurdish town of Sarpol-e-Zahab in the western Iranian province of Kermanshah. Full-scale rescue operation could start only with the dawn, and yet unknown, are still people under the rubble.

Watford rebuff Everton approach for Marco Silva
Watford have issued a hands off warning to Everton , and will not entertain another approach for manager Marco Silva . Dyche, thought to be keen on talking to Everton, would cost £2.5 million in compensation.

Robbers dig tunnel to rob bank in Navi Mumbai
The robbery is believed to have taken place at a branch of Bank of Baroda in the Juninagar area near Navi Mumbai early Sunday. When the customer and a bank officer entered the locker room, they found that 27 lockers had been looted.

Kim Kardashian Reads Kanye's Mean Tweets on Jimmy Kimmel Live
Oh no that means you would have gotten too much good p***y in your life", wrote West in all-caps. "Neither is David Letterman ". But Kim Kardashian got way more personal, reciting a zinger that now-husband Kanye West fired at Kimmel during their 2013 feud.

Tyson Foods, Inc. (NASDAQ:TSN) To Report Earnings
TRADEMARK VIOLATION NOTICE: This piece of content was originally posted by Week Herald and is the sole property of of Week Herald. The company reported $1.43 earnings per share (EPS) for the quarter, topping the Zacks' consensus estimate of $1.19 by $0.24.